registry / triflux / 10.80.0

triflux@10.80.0

CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The postinstall path performs guarded Codex hook setup, creating residual agent extension lifecycle risk. The inspected sources do not establish a concrete attack, and hook trust requires explicit approval.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package through npm where its postinstall runs.

Impact

The package adds hooks to a user's Codex configuration, but the source leaves their approval to Codex or a later explicit setup action.

Mechanism

The setup script calls the Codex hook installer with trust disabled; the installer writes session-start and prompt-submit hook entries.

AI rationale

Evidence

package.jsonscripts/setup.mjsscripts/ensure-codex-hooks.mjs~/.codex/hooks.json~/.codex/config.toml

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs scripts/setup.mjs automatically from postinstall.
The installer adds Codex session-start and prompt-submit hooks with trust disabled.
When setup is noninteractive, hook approval is deferred to a later tfx setup command.

Evidence against

The Codex hooks are not trusted automatically; explicit approval is requested interactively or deferred.
The runtime hints inspected render and sanitize session details; they do not establish a separate attack.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 154 file(s), 1.77 MB of source, external domains: api.openai.com, developers.openai.com, github.com, platform.claude.com, registry.npmjs.org

Source & flagged code

25 flagged

package.jsonView file

Lines 1-38json

2 "name": "triflux",

3 "version": "10.80.0",

4 "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",

5 "type": "module",

6 "bin": {

7 "triflux": "bin/triflux.mjs",

8 "tfx": "bin/triflux.mjs",

9 "tfx-live": "bin/tfx-live.mjs",

10 "tfx-peer": "bin/tfx-peer.mjs",

11 "tfx-setup": "bin/tfx-setup.mjs",

12 "tfx-doctor": "bin/tfx-doctor.mjs"

13 },

14 "engines": {

15 "node": ">=22"

16 },

17 "scripts": {

18 "postinstall": "node scripts/setup.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "dependencies": {

21 "@iarna/toml": "^2.2.5"

22 },

23 "files": [

24 "adapters",

25 "bin",

26 "config",

27 ".claude/rules/tfx-routing.md",

28 "skills",

29 "!skills/tfx-workspace",

30 "hooks",

31 "hud",

32 "scripts",

33 "!scripts/__tests__",

34 "hub",

35 "docs/assets/logo-dark.svg",

36 "docs/assets/logo-light.svg",

37 "docs/assets/social-preview.png",

38 "docs/assets/social-preview.svg",

bin/tfx-live.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFile } from "node:child_process";

3import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/tfx-live.mjsView on unpkg · L1

4import {

5 existsSync,

bin/triflux.mjsView file

Lines 1520-1560javascript

1520 report.alreadyInGoalState = false;

1521 }

1522 } else

1523 addWarning(report, "statusline", "HUD 파일 없음: 먼저 파일 동기화 필요");

1524

1525 const consent =

scripts/lib/install-retire.mjsView file

Lines 29-69javascript

29 /^synapse-sessions\.json$/,

30 /^team-native-.+\.json$/,

31];

32// 토큰 사본은 보관하지 않고 바로 지운다.

33const

scripts/setup.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// triflux 설치 및 업데이트 설정 스크립트

4// - tfx-route.sh를 ~/.claude/scripts/에 동기화

5// - hud-qos-status.mjs를 ~/.claude/hud/에 동기화

6// - skills/를 ~/.claude/skills/에 동기화

8import { createHash } from "node:crypto";

9import { execFileSync, spawn } from

scripts/mcp-check.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: , config)); } } } for (const mcpjson of scanpluginsmcpjson()) { for (const { name, config } of extractmcpservernames(mcpjson)) { if (!servermap.has(name)) { servermap.set(name, createserverrecord(name, "configured", config)); } } } for (const settingsfile of ["settings.json", "settings.local.json"]) { const data = readjsonsafe(join(claude_dir, settingsfile)); if (!data?.mcpservers) continue; for (const [name, config] of object.entries(data.mcpservers)) { if (typeof name !== "string" || !name.trim()) continue; if (!servermap.has(n

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/mcp-check.mjsView on unpkg

scripts/ensure-codex-hooks.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. nction mergehooksstate(content, entries, hookspath) { const managedkeys = new set(entries.map((entry) => entry.key)); if (hooksstateconverged(content, entries, hookspath)) { return content; } return appendstateblocks( stripmanagedstatelines(content, managedkeys, hookspath), entries, ); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/ensure-codex-hooks.mjsView on unpkg

scripts/lib/codex-recovery.shView file

•path = scripts/lib/codex-recovery.sh kind = build_helper sizeBytes = 3399 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/lib/codex-recovery.shView on unpkg

hub/team/headless.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hub/team/headless.mjs#virtual:normalized:round1View on unpkg

hub/team/headless.mjsView file

•matchType = normalized_sha256 matchedPackage = triflux@10.77.0 matchedPath = hub/team/headless.mjs matchedIdentity = npm:dHJpZmx1eA:10.77.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High